SSL errors appearing right after migrating to a new server almost always mean the certificate (and its matching private key) simply wasn't carried over as part of the migration — moving site files and a database doesn't automatically bring the certificate installation along with it.
The fix
Either reinstall the original certificate and its private key on the new server (if you retained a secure copy), or issue a fresh certificate directly on the new server — the latter is often simpler if you're using a free, automated CA, avoiding the need to securely transfer the old private key at all.
What commonly gets missed during a server migration that causes certificate errors afterward
The most common post-migration certificate issues stem from either the private key not being correctly copied alongside the certificate, or the intermediate certificate bundle being forgotten during the transfer — both covered in more detail in our dedicated certificate migration guide.
How to verify a migrated certificate is genuinely correctly installed rather than assuming success
Running an SSL scan tool or direct OpenSSL check against the newly migrated server, rather than assuming a successful file copy means correct installation, confirms the certificate, key, and chain are all genuinely working together correctly on the new infrastructure.
What a step-by-step verification sequence looks like after any server migration
Checking the certificate is present, checking the private key matches (via the modulus comparison technique), checking the intermediate bundle is included, and testing an actual live connection with OpenSSL — four checks that together confirm a genuinely complete, correct migration rather than assuming success from a file copy alone.
How DNS propagation timing can create a temporary, self-resolving version of this issue
If a server migration also involved a DNS change, some visitors may briefly be routed to the old server (still showing old certificate behavior) while DNS propagates fully — this specific version of the issue typically self-resolves within the normal DNS propagation window without requiring any additional server-side fix.
A final note on building a repeatable checklist
Building a standard, repeatable migration checklist based on the specific verification steps covered in our dedicated certificate migration guide ensures every future server migration your team performs follows the same careful, complete verification process rather than depending on one person's memory of the correct steps.
What the exact verification sequence looks like step by step
First confirm the certificate file matches what you expect via its serial number, then confirm the private key matches via modulus comparison, then confirm the intermediate bundle is present via a chain check, then test an actual live connection — four sequential checks providing complete confidence in a migration's success.
How to handle a migration where the new server needs a different certificate format entirely
If your new server software expects a different format than your old one provided, converting using the techniques covered in our dedicated certificate format conversion guide is a normal, expected part of a cross-platform migration, not a sign of any underlying problem with the certificate itself.
A quick closing checklist
A quick closing checklist covers verifying the certificate, key match, and complete chain individually after any migration, testing with an external SSL scan tool for independent confirmation, and maintaining a repeatable migration checklist for consistency across future transitions.
Why keeping the old server briefly available after migration provides a valuable safety net
Retaining the old server in a stopped-but-recoverable state for a short period after migration, rather than immediately decommissioning it, provides a fast rollback option if a post-migration certificate issue turns out to be more complex than initially anticipated.